Attackers hijacked three country-code top-level domains and obtained unauthorized HTTPS certificates for several Google domains.